Detecting digital content misuse based on know violator usage clusters

1. A method comprising:

gathering, by a digital content delivery system, usage signal data describing digital content usage by a plurality of violating user accounts that are known digital content violators;

generating, based on the usage signal data, a set of data points, each data point from the set of data points corresponding to a unique violating user account of the plurality of violating user accounts and having been generated based on usage signal data describing digital content usage associated with the respective violating unique user account corresponding to the respective data point;

clustering, based on a clustering algorithm, the set of data points into a set of known violator clusters, each known violator cluster from the set of known violator clusters having a determined center;

determining, based on the set of known violator clusters, that a first user account is potentially a digital content violator, the first user account being represented by a first data point that is not included in the first set of data points, and the first data point having been determined based on usage signal data describing digital content usage association with the first user account, wherein determining that the first user account is potentially a digital content violator comprises determining that a distance between the first data point and the respective center of a closest known violator cluster is less than a threshold distance; and

in response to determining that the first user account is potentially a digital content violator, placing a restriction on the first user account, the restriction disabling the first user account from accessing digital content from the digital content delivery system.

2. The method of claim 1 , wherein the usage signal data describing digital content usage associated with the unique user account represented by the data point includes one or more of a number of times digital content was accessed, a frequency at which digital content was accessed, digital content items that were accessed, a geographic location of a client-side computing device associated with the unique user account, a number of known family members residing in a dwelling associated with the unique user account, and a number of mobile computing devices detected during performance of digital content.

3. The method of claim 1 , wherein determining that the first user account is potentially a digital content violator further comprises:

determining, from the set of known violator clusters, a subset of known violator clusters that meet a quality threshold level; and

determining that a distance between the first data point and the respective center of a closest known violator cluster from the subset of known violator clusters is less than a predetermined threshold distance.

4. The method of claim 1 , further comprising:

determining that an unauthorized copy of digital content is embedded with a watermark that identifies a user account; and

adding the user account identified by the watermark to the set of violating user accounts.

5. The method of claim 1 , wherein the set of digital content usage clusters are generated using at least one clustering algorithm.

6. The method of claim 5 , wherein the at least one clustering algorithm includes a k-means clustering algorithm.

7. The method of claim 1 , further comprising:

scanning social media activity of a user associated with the first client-side computing device for postings made by the user that indicate that the user is allowing unauthorized access to the digital content.

8. The method of claim 1 , further comprising:

causing the first client-side computing device to be temporarily disabled from presenting digital content.

9. The method of claim 1 , further comprising:

causing the first client-side computing device to suspend performance of digital content.

10. A digital content delivery system comprising:

one or more computer processors; and

one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause the digital content delivery system to perform operations comprising:

gathering usage signal data describing digital content usage by a plurality of violating user accounts that are known digital content violators;

generating, based on the usage signal data, a set of data points, each data point from the set of data points corresponding to a unique violating user account of the plurality of violating user accounts and having been generated based on usage signal data describing digital content usage associated with the respective violating unique user account corresponding to the respective data point;

clustering, based on a clustering algorithm, the set of data points into a set of known violator clusters, each known violator cluster from the set of known violator clusters having a determined center;

determining, based on the set of known violator clusters, that a first user account is potentially a digital content violator, the first user account being represented by a first data point that is not included in the first set of data points, and the first data point having been determined based on usage signal data describing digital content usage association with the first user account, wherein determining that the first user account is potentially a digital content violator comprises determining that a distance between the first data point and the respective center of a closest known violator cluster is less than a threshold distance; and

in response to determining that the first user account is potentially a digital content violator, placing a restriction on the first user account, the restriction disabling the first user account from accessing digital content from the digital content delivery system.

11. The digital content delivery system of claim 10 , wherein the usage signal data describing digital content usage associated with the unique user account represented by the data point includes one or more of a number of times digital content was accessed, a frequency at which digital content was accessed, digital content items that were accessed, a geographic location of a client-side computing device associated with the unique user account, a number of known family members residing in a dwelling associated with the unique user account, and a number of mobile computing devices detected during performance of digital content.

12. The digital content delivery system of claim 10 , wherein determining that the first user account is potentially a digital content violator further comprises:

determining, from the set of known violator clusters, a subset of known violator clusters that meet a quality threshold level; and

determining that a distance between the first data point and the respective center of a closest known violator cluster from the subset of known violator clusters is less than a predetermined threshold distance.

13. The digital content delivery system of claim 10 , the operations further comprising:

determining that an unauthorized copy of digital content is embedded with a watermark that identifies a user account; and

adding the user account identified by the watermark to the set of violating user accounts.

14. The digital content delivery system of claim 10 , wherein the set of digital content usage clusters are generated using at least one clustering algorithm.

15. The digital content delivery system of claim 14 , wherein the at least one clustering algorithm includes a k-means clustering algorithm.

16. The digital content delivery system of claim 10 , the operations further comprising:

scanning social media activity of a user associated with the first client-side computing device for postings made by the user that indicate that the user is allowing unauthorized access to the digital content.

17. The digital content delivery system of claim 10 , the operations further comprising:

causing the first client-side computing device to be temporarily disabled from presenting digital content.

18. The method of claim 1 , the operations further comprising:

causing the first client-side computing device to suspend performance of digital content.

19. A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of a digital content delivery system, cause the digital content delivery system to perform operations comprising:

gathering usage signal data describing digital content usage by a plurality of violating user accounts that are known digital content violators;

generating, based on the usage signal data, a set of data points, each data point from the set of data points corresponding to a unique violating user account of the plurality of violating user accounts and having been generated based on usage signal data describing digital content usage associated with the respective violating unique user account corresponding to the respective data point;

clustering, based on a clustering algorithm, the set of data points into a set of known violator clusters, each known violator cluster from the set of known violator clusters having a determined center;

determining, based on the set of known violator clusters, that a first user account is potentially a digital content violator, the first user account being represented by a first data point that is not included in the first set of data points, and the first data point having been determined based on usage signal data describing digital content usage association with the first user account, wherein determining that the first user account is potentially a digital content violator comprises determining that a distance between the first data point and the respective center of a closest known violator cluster is less than a threshold distance; and

in response to determining that the first user account is potentially a digital content violator, placing a restriction on the first user account, the restriction disabling the first user account from accessing digital content from the digital content delivery system.